SQUID Frequently Asked Questions

Duane Wessels, wessels@ircache.net

1. About Squid, this FAQ, and other Squid information resources

• 1.1 What is Squid?
• 1.2 What is Internet object caching?
• 1.3 Why is it called Squid?
• 1.4 What is the latest version of Squid?
• 1.5 Who is responsible for Squid?
• 1.6 Where can I get Squid?
• 1.7 What Operating Systems does Squid support?
• 1.8 Does Squid run on Windows NT?
• 1.9 What Squid mailing lists are available?
• 1.10 I can't figure out how to unsubscribe from your mailing list.
• 1.11 What Squid web pages are available?
• 1.12 Does Squid support SSL?
• 1.13 What's the legal status of Squid?
• 1.14 Is Squid year-2000 compliant?
• 1.15 Can I pay someone for Squid support?
• 1.16 Squid FAQ contributors
• 1.17 About This Document

2. Getting and Compiling Squid

• 2.1 Which file do I download to get Squid?
• 2.2 How do I compile Squid?
• 2.3 What kind of compiler do I need?
• 2.4 Do you have pre-compiled binaries available?
• 2.5 How do I apply a patch or a diff?
• 2.6 configure options
• 2.7 src/Makefile options
• 2.8 undefined reference to __inet_ntoa
• 2.9 How can I get true DNS TTL info into Squid's IP cache?
• 2.10 My platform is BSD/OS or BSDI and I can't compile Squid
• 2.11 Problems compiling libmiscutil.a on Solaris
• 2.12 I have problems compiling Squid on Platform Foo.
• 2.13 I see a lot warnings while compiling Squid.
• 2.14 Building Squid on OS/2

3. Installing and Running Squid

• 3.1 How big of a system do I need to run Squid?
• 3.2 How do I install Squid?
• 3.3 What does the squid.conf file do?
• 3.4 Do you have a squid.conf example?
• 3.5 How do I start Squid?
• 3.6 How do I start Squid automatically when the system boots?
• 3.7 How do I tell if Squid is running?
• 3.8 squid command line options
• 3.9 How do I see how Squid works?

4. Configuration issues

• 4.1 How do I join a cache hierarchy?
• 4.2 How do I join NLANR's cache hierarchy?
• 4.3 Why should I want to join NLANR's cache hierarchy?
• 4.4 How do I register my cache with NLANR's registration service?
• 4.5 How do I find other caches close to me and arrange parent/child/sibling relationships with them?
• 4.6 My cache registration is not appearing in the Tracker database.
• 4.7 What is the httpd-accelerator mode?
• 4.8 How do I configure Squid to work behind a firewall?
• 4.9 I have dnsserver processes that aren't being used, should I lower the number in squid.conf?
• 4.10 My dnsserver average/median service time seems high, how can I reduce it?
• 4.11 How can I easily change the default HTTP port?
• 4.12 Is it possible to control how big each cache_dir is?
• 4.13 I'm adding a new cache_dir. Will I lose my cache?
• 4.14 Squid and http-gw from the TIS toolkit.
• 4.15 What is ``HTTP_X_FORWARDED_FOR''? Why does squid provide it to WWW servers, and how can I stop it?
• 4.16 Can Squid anonymize HTTP requests?

5. Communication between browsers and Squid

• 5.1 Netscape manual configuration
• 5.2 Netscape automatic configuration
• 5.3 Lynx and Mosaic configuration
• 5.4 Redundant Auto-Proxy-Configuration
• 5.5 Microsoft Internet Explorer configuration
• 5.6 Netmanage Internet Chameleon WebSurfer configuration
• 5.7 Opera 2.12 proxy configuration
• 5.8 How do I tell Squid to use a specific username for FTP urls?

6. Squid Log Files

• 6.1 access.log
• 6.2 hierarchy.log
• 6.3 store.log
• 6.4 Field Definitions
• 6.5 Cache Result Codes
• 6.6 Peer Status Codes
• 6.7 HTTP status codes
• 6.8 cache/log or swap.state
• 6.9 Which log files can I delete safely?
• 6.10 How can I disable Squid's log files?
• 6.11 My log files get very big!
• 6.12 Why do I get ERR_NO_CLIENTS_BIG_OBJ messages so often?
• 6.13 What does ERR_LIFETIME_EXP mean?
• 6.14 Retrieving ``lost'' files from the cache

7. Operational issues

• 7.1 How do I see system level Squid statistics?
• 7.2 How can I find the biggest objects in my cache?
• 7.3 I want to restart Squid with a clean cache
• 7.4 How can I proxy/cache Real Audio?
• 7.5 How can I purge an object from my cache?
• 7.6 Using ICMP to Measure the Network
• 7.7 Why are so few requests logged as TCP_IMS_MISS?
• 7.8 How can I make Squid NOT cache objects which match local_domain or local_ip?
• 7.9 How can I delete and recreate a cache directory?
• 7.10 Why can't I run Squid as root?
• 7.11 Can you tell me a good way to upgrade Squid with minimal downtime?

8. Memory

• 8.1 Why does Squid use so much memory!?
• 8.2 How can I tell how much memory my Squid process is using?
• 8.3 My Squid process grows without bounds.
• 8.4 I set cache_mem to XX, but the process grows beyond that!
• 8.5 How do I analyze memory usage from the cache manger output?
• 8.6 The ``Total memory accounted'' value is less than the size of my Squid process.
• 8.7 xmalloc: Unable to allocate 4096 bytes!
• 8.8 fork: (12) Cannot allocate memory
• 8.9 What can I do to reduce Squid's memory usage?
• 8.10 Using an alternate malloc library.

9. The Cache Manager

• 9.1 What is the cache manager?
• 9.2 How do you set it up?
• 9.3 Cache manager configuration for CERN httpd 3.0
• 9.4 Cache manager configuration for Apache
• 9.5 Cache manager ACLs in squid.conf
• 9.6 Why does it say I need a password and a URL?
• 9.7 I want to shutdown the cache remotely. What's the password?
• 9.8 How do I make the cache host default to my cache?
• 9.9 What's the difference between Squid TCP connections and Squid UDP connections?
• 9.10 It says the storage expiration will happen in 1970!
• 9.11 What do the Meta Data entries mean?
• 9.12 In the utilization section, what is Other?
• 9.13 In the utilization section, why is the Transfer KB/sec
• 9.14 In the utilization section, what is the Object Count?
• 9.15 In the utilization section, what is the Max/Current/Min KB?
• 9.16 What is the I/O section about?
• 9.17 What is the Objects section for?
• 9.18 What is the VM Objects section for?
• 9.19 What does AVG RTT mean?
• 9.20 In the IP cache section, what's the difference between a hit, a negative hit and a miss?
• 9.21 What do the IP cache contents mean anyway?
• 9.22 What is the fqdncache and how is it different from the ipcache?
• 9.23 What does ``Page faults with physical i/o: 4897'' mean?
• 9.24 What does the IGNORED field mean in the 'cache server list'?

10. Access Controls

• 10.1 How do I implement an ACL ban list?
• 10.2 How do I block specific users or groups from accessing my cache?
• 10.3 Do you have a CGI program which lets users change their own proxy passwords?
• 10.4 Is there a way to do ident lookups only for a certain host and compare the result with a userlist in squid.conf?
• 10.5 Common Mistakes
• 10.6 I set up my access controls, but they don't work! why?
• 10.7 Proxy-authentication and neighbor caches
• 10.8 Is there an easy way of banning all Destination addresses except one?
• 10.9 Does anyone have a ban list of porn sites and such?
• 10.10 Squid doesn't match my subdomains
• 10.11 Why does Squid deny some port numbers?

11. Troubleshooting

• 11.1 Why am I getting ``Proxy Access Denied?''
• 11.2 I can't get local_domain to work; Squid is caching the objects from my local servers.
• 11.3 I get Connection Refused when the cache tries to retrieve an object located on a sibling, even though the sibling thinks it delivered the object to my cache.
• 11.4 Running out of filedescriptors
• 11.5 What are these strange lines about removing objects?
• 11.6 Can I change a Windows NT FTP server to list directories in Unix format?
• 11.7 Why am I getting ``Ignoring MISS from non-peer x.x.x.x?''
• 11.8 DNS lookups for domain names with underscores (_) always fail.
• 11.9 Why does Squid say: ``Illegal character in hostname; underscores are not allowed?'
• 11.10 Why am I getting access denied from a sibling cache?
• 11.11 Cannot bind socket FD NN to *:8080 (125) Address already in use
• 11.12 icpDetectClientClose: ERROR xxx.xxx.xxx.xxx: (32) Broken pipe
• 11.13 icpDetectClientClose: FD 135, 255 unexpected bytes
• 11.14 How come Squid doesn't work with NTLM Authorization.
• 11.15 The default parent option isn't working!
• 11.16 ``Hot Mail'' complains about: Intrusion Logged. Access denied.
• 11.17 My Squid becomes very slow after it has been running for some time.
• 11.18 WARNING: Failed to start 'dnsserver'
• 11.19 Sending in Squid bug reports
• 11.20 Debugging Squid
• 11.21 FATAL: ipcache_init: DNS name lookup tests failed
• 11.22 FATAL: Failed to make swap directory /var/spool/cache: (13) Permission denied
• 11.23 FATAL: Cannot open HTTP Port
• 11.24 FATAL: All redirectors have exited!
• 11.25 You've run out of swap file numbers.
• 11.26 When using a username and password, I can not access some files.
• 11.27 pingerOpen: icmp_sock: (13) Permission denied
• 11.28 What is a forwarding loop?
• 11.29 accept failure: (71) Protocol error
• 11.30 storeSwapInFileOpened: ... Size mismatch
• 11.31 Why do I get fwdDispatch: Cannot retrieve 'https://www.buy.com/corp/ordertracking.asp'

12. How does Squid work?

• 12.1 What are cachable objects?
• 12.2 What is the ICP protocol?
• 12.3 What is the dnsserver?
• 12.4 What is the ftpget program for?
• 12.5 FTP PUT's don't work!
• 12.6 What is a cache hierarchy? What are parents and siblings?
• 12.7 What is the Squid cache resolution algorithm?
• 12.8 What features are Squid developers currently working on?
• 12.9 Tell me more about Internet traffic workloads
• 12.10 What are the tradeoffs of caching with the NLANR cache system?
• 12.11 Where can I find out more about firewalls?
• 12.12 What is the ``Storage LRU Expiration Age?''
• 12.13 What is ``Failure Ratio at 1.01; Going into hit-only-mode for 5 minutes''?
• 12.14 Does squid periodically re-read its configuration file?
• 12.15 How does unlinkd work?
• 12.16 What is an icon URL?
• 12.17 Can I make my regular FTP clients use a Squid cache?
• 12.18 Why is the select loop average time so high?
• 12.19 How does Squid deal with Cookies?
• 12.20 How does Squid decide when to refresh a cached object?
• 12.21 What exactly is a deferred read?
• 12.22 Why is my cache's inbound traffic equal to the outbound traffic?
• 12.23 How come some objects do not get cached?
• 12.24 What does keep-alive ratio mean?
• 12.25 How does Squid's cache replacement algorithm work?
• 12.26 What are private and public keys?

13. Multicast

• 13.1 What is Multicast?
• 13.2 How do I know if I'm on the Mbone?
• 13.3 Should I be using Multicast ICP?
• 13.4 How do I configure Squid to send Multicast ICP queries?
• 13.5 How do I know what Multicast TTL to use?
• 13.6 How do I configure Squid to receive and respond to Multicast ICP?

14. System-Dependent Weirdnesses

• 14.1 Solaris
• 14.2 FreeBSD
• 14.3 OSF1/3.2
• 14.4 BSD/OS
• 14.5 Linux
• 14.6 HP-UX
• 14.7 IRIX
• 14.8 SCO-UNIX

15. Redirectors

• 15.1 What is a redirector?
• 15.2 Why use a redirector?
• 15.3 How does it work?
• 15.4 Can I use the redirector to return HTTP redirect messages?
• 15.5 FATAL: All redirectors have exited!

16. Cache Digests

• 16.1 What is a Cache Digest?
• 16.2 How and why are they used?
• 16.3 What is the theory behind Cache Digests?
• 16.4 How is the size of the Cache Digest in Squid determined?
• 16.5 What hash functions (and how many of them) does Squid use?
• 16.6 How are objects added to the Cache Digest in Squid?
• 16.7 Does Squid support deletions in Cache Digests? What are diffs/deltas?
• 16.8 When and how often is the local digest built?
• 16.9 How are Cache Digests transferred between peers?
• 16.10 How and where are Cache Digests stored?
• 16.11 How are the Cache Digest statistics in the Cache Manager to be interpreted?
• 16.12 What are False Hits and how should they be handled?
• 16.13 How can Cache Digest related activity be traced/debugged?
• 16.14 What about ICP?
• 16.15 Is there a Cache Digest Specification?

17. Transparent Caching/Proxying

• 17.1 Transparent proxying for Solaris, SunOS, and BSD systems
• 17.2 Transparent proxying for Linux
• 17.3 Transparent proxying with Cisco
• 17.4 Transparent proxying with LINUX 2.0.29 and CISCO IOS 11.1
• 17.5 The cache is trying to connect to itself...
• 17.6 Transparent caching with FreeBSD
• 17.7 Transparent caching with Linux and ipchains
• 17.8 Transparent Proxying with ACC Tigris digital access server
• 17.9 ``Connection reset by peer'' and Cisco policy routing

18. SNMP

• 18.1 Does Squid support SNMP?
• 18.2 Enabling SNMP in Squid
• 18.3 Configuring Squid 2.2
• 18.4 Configuring Squid 2.1
• 18.5 How can I query the Squid SNMP Agent
• 18.6 What can I use SNMP and Squid for?
• 18.7 How can I use SNMP with Squid?
• 18.8 Where can I get more information/discussion about Squid and SNMP?

19. Squid version 2

• 19.1 What are the new features?
• 19.2 How do I configure 'ssl_proxy' now?
• 19.3 Logfile rotation doesn't work with Async I/O
• 19.4 Adding a new cache disk
• 19.5 Squid 2 performs badly on Linux
• 19.6 How do I configure proxy authentication with Squid-2?
• 19.7 Why does proxy-auth reject all users with Squid-2.2?
• 19.8 Delay Pools
• 19.9 Can I preserve my cache when upgrading from 1.1 to 2?
• 19.10 Customizable Error Messages
• 19.11 My squid.conf from version 1.1 doesn't work!

20. httpd-accelerator mode

• 20.1 What is the httpd-accelerator mode?
• 20.2 How do I set it up?
• 20.3 When using an httpd-accelerator, the port number for redirects is wrong

21. Related Software

• 21.1 Clients
• 21.2 Logfile Analysis
• 21.3 Configuration Tools
• 21.4 Squid add-ons

22. Terms and Definitions

• 22.1 Neighbor